Interdicting Attack Plans with Boundedly Rational Players and Multiple Attackers: An Adversarial Risk Analysis Approach.

This article focuses on a novel cybersecurity planning framework that models the selection of security controls to mitigate risks from multiple boundedly rational adversaries with varying strategic sophistication. It extends adversarial risk analysis (ARA) by integrating cognitive hierarchy theory into a maximum-reliability path interdiction problem, formulating attacker and defender decisions as mixed integer programming models. The authors introduce an iterative algorithm to solve these models and propose an approximation algorithm with a guaranteed performance bound to efficiently identify near-optimal defensive portfolios under budget constraints. A case study demonstrates how defensive strategies evolve with the defender’s and attackers’ levels of strategic sophistication, highlighting that overestimating attacker sophistication may be preferable to underestimating it. The approach provides decision makers with a suite of security investment options and can be regularly updated to address emerging vulnerabilities in resource-constrained environments.